CVE-2025-3680: PCMan FTP Server Buffer Overflow Flaw

CVE-2025-3680 Overview

CVE-2025-3680 is a buffer overflow vulnerability in PCMan FTP Server version 2.0.7. The flaw resides in the LANG command handler component and stems from improper bounds checking [CWE-119]. Remote attackers can trigger the overflow by sending crafted input to the FTP service without authentication. The exploit code has been publicly disclosed, increasing the likelihood of opportunistic attacks against exposed instances. PCMan FTP Server is a legacy Windows FTP daemon historically used for small-scale file sharing, and version 2.0.7 remains in circulation despite the project being unmaintained.

Critical Impact
Remote, unauthenticated attackers can corrupt memory in the FTP service through the LANG command, leading to service disruption and potential code execution on the host.

Affected Products

PCMan FTP Server 2.0.7
Component: LANG Command Handler
Deployment: Windows hosts running the affected FTP service

Discovery Timeline

2025-04-16 - CVE-2025-3680 published to NVD
2025-04-29 - Last updated in NVD database

Technical Details for CVE-2025-3680

Vulnerability Analysis

The vulnerability is a classic buffer overflow [CWE-119] in the handler responsible for processing the FTP LANG command. PCMan FTP Server 2.0.7 fails to validate the length of attacker-supplied input before copying it into a fixed-size stack buffer. When an oversized argument is provided to the LANG verb, adjacent memory and stack control structures are overwritten.

Because the FTP protocol allows clients to issue commands prior to authentication on many configurations, the attack surface is exposed to anonymous network clients. The PCMan FTP Server codebase has a long history of similar command-parsing buffer overflows, reflecting systemic lack of input validation across multiple verb handlers.

Root Cause

The root cause is the absence of length checks when parsing the argument supplied to the LANG command. The handler uses unsafe string copy semantics that trust the client-supplied data, allowing the source buffer to exceed the destination capacity. This pattern is consistent with C/C++ string-handling functions that do not enforce destination bounds.

Attack Vector

The attack vector is network-based and requires no privileges or user interaction. An attacker establishes a TCP connection to the FTP control port and issues a LANG command with an oversized argument. Successful exploitation can crash the service or, depending on exploit reliability and protections such as DEP and ASLR, lead to arbitrary code execution in the context of the FTP server process. Public exploit details are referenced in the Fitoxs Exploit Details and VulDB entry #304969.

No verified code examples are available. Refer to the public advisory for technical reproduction details.

Detection Methods for CVE-2025-3680

Indicators of Compromise

Unexpected termination or repeated crashes of the PCMan FTP Server process on Windows hosts.
FTP control session logs containing LANG commands with abnormally long arguments.
Outbound connections initiated by the FTP server process following inbound traffic on the FTP control port.
Creation of new processes by the FTP server parent process, indicating possible shellcode execution.

Detection Strategies

Inspect network traffic on FTP control ports for LANG commands exceeding typical argument lengths (a few bytes for valid language codes).
Monitor Windows Event Logs for application crashes referencing the PCMan FTP Server executable.
Apply intrusion detection signatures that flag oversized FTP verbs against legacy FTP daemons.

Monitoring Recommendations

Enable verbose FTP command logging and forward logs to a centralized analytics platform for anomaly review.
Alert on FTP server processes spawning command interpreters such as cmd.exe or powershell.exe.
Track network baselines for the FTP host and flag unexpected outbound connectivity that may indicate post-exploitation activity.

How to Mitigate CVE-2025-3680

Immediate Actions Required

Remove or disable PCMan FTP Server 2.0.7 from production environments, as the project is unmaintained.
Restrict network access to the FTP control port using host-based and perimeter firewalls until the service can be replaced.
Replace PCMan FTP Server with an actively maintained FTP/SFTP solution that receives security updates.

Patch Information

No vendor patch is available for PCMan FTP Server 2.0.7. The product does not have an active maintenance channel, and no fixed release addressing CVE-2025-3680 has been published. Migration to a supported FTP/SFTP server is the recommended remediation path.

Workarounds

Block inbound TCP/21 traffic at the network perimeter and limit access to trusted management subnets.
Run the FTP service under a low-privileged account to reduce the impact of successful code execution.
Place the FTP host behind a protocol-aware proxy that enforces command and argument length limits.
Decommission the service if file transfer functionality is no longer required.

bash

# Configuration example: Windows Firewall rule restricting FTP control port
netsh advfirewall firewall add rule name="Restrict PCMan FTP" ^
  dir=in action=block protocol=TCP localport=21